Codex 0.159.3 -> 0.160.0 with the Python SDK pair: pins, qualification receipt, tests and checkpoint

[seathatflowsinourveins]

Scope

• What this PR changes: moves the Linux Codex pin and the coupled Python SDK pair (openai-codex, openai-codex-cli-bin) from 0.159.3 to rust-v0.160.0. It brings every current-pin site along: tests, landscape snapshot, generated reports, prose and the dashboard checkpoint. It adds the qualification receipt runtime-sdk-20261003.
  • macOS stays at 0.155.1.
  • The shared host launcher and app-server daemon keep running 0.159.3 until a coordinated host switch. Per codex-rs/app-server-daemon/README.md:127-128, that switch must use codex app-server daemon update --from-cli.
• Base commit: 56473e4b8
• Lane: lane:shared.
  • It touches manifests/stack.json, manifests/evidence.json, observability/grand-dashboard/state.json and adoption/sdk/.
  • It changes one trading line: blueprints/us-equities/workers/requirements.txt:1, openai-codex==0.159.3 → ==0.160.0.
  • A trading acknowledgement is needed before merge.
• Owned paths touched: see the diff. Configuration-owner files (adoption/new-wsl/**, evidence/artifacts/new-wsl-*, the definitive manifest) are untouched.

SOTA sources

• Codex, rust-v0.160.0 (a956835d020762cb2b570053af06f643a11c0ecc, published 2026-10-01T20:19:13Z). The current stable release. sdk/python is byte-identical to rust-v0.159.2/0.159.3 (tree 297fc74e). The config schema delta is additive: six property paths, no removals. codex-rs/state adds no SQL migrations.
• npm wrapper: @openai/codex@0.160.0. dist.integrity matched the downloaded bytes; sha256 373517768e912eeb5054024ae9215e2c90a1420957b66fe134ef745a00948d4a.
• PyPI: openai-codex 0.160.0 (wheel sha256 61d2d855…, requires_dist openai-codex-cli-bin==0.160.0) and openai-codex-cli-bin 0.160.0.
• uv 0.12.17: the lock was compiled with the adoption/sdk/README.md command from the repository root.
• Precedent for receipt kind and structure: Qualify Codex 0.159.3 and align the SDK pair #580 (0.159.3) and Codex CLI 0.159.2 pin with qualification receipt; Codex template default GPT-6.1 Sol/Ultra with Astra escalation (unit D4) #542 (0.159.2).

Evidence-class table

Claim	Evidence class	Command / receipt
Installing the npm wrapper gives a native binary reporting codex-cli 0.160.0 (sha256 12eb3e81…); codex exec --help is unchanged from 0.159.3	native_proven (this host)	evidence/artifacts/runtime-sdk-20261003/receipt.json
The SDK lock (36 distributions, 867 hashes) changes only the SDK pair from main; strict-hash sync and uv pip check pass in a fresh venv	native_proven	same receipt; lock sha256 3a17fa09…
Native-account SDK canary, gateway SDK canary (cx/gpt-6.1-sol, effort max requested) and gateway CLI exec canary return their exact markers	native_proven (marker turns only)	same receipt
Backend model and effort delivered through the gateway	not observed	limits in the receipt
New-host, model-quality or macOS acceptance	not claimed

Local commands run

$ python3 scripts/validate.py                              -> exit 0 (69 components, 9,319 files, 187 receipts)
$ python3 scripts/validate_convergence.py --all-recorded   -> exit 0
$ python3 scripts/landscape.py --root .                     -> exit 0
$ python3 -B -m unittest tests.test_grand_dashboard tests.test_adoption_contract tests.test_codex_worker_lane tests.test_render_config tests.test_adoption_bootstrap_macos tests.test_stack_lifecycle -> 337 tests OK (skipped=42)
$ release_due / validate_catalogs / validate_foundation / audit_reports / build_verdicts / component_matrix --check / new_host_grand_list --check / gap_crosswalk --check / build_ecosystem --check -> all exit 0
$ python3 -m unittest (full)                                -> on this host, the same environment-sensitive modules fail on main 56473e4b8 too (token_e2e_grader, native_faults_min, credential_run, lane_packets and others; failure sets differ run to run); hosted CI is the observation

Reviews

• Opus evidence review: changes-needed (1 blocking: the dashboard token pattern; 3 should-fix; 5 minor). All were repaired in one round.
• GPT-6.1 Sol cross-family review: accept. Its one minor note is a trading-owner wording item, handed over below.
• Handed over, not changed here:
  • blueprints/us-equities/workers/README.md:3 still says SDK 0.159.2 (trading owner).
  • The replacement-WSL profile records 0.159.3 (configuration owner).
  • recipes/README.md:67 is a historical complete-package hash.

Decision record

No new decision document. The pin follows the standing currency practice, and the qualification is evidence/receipts/runtime-sdk-20261003.json. The move falls inside the 7-day cooldown that docs/decisions/2026-09-25-workstation-sota-refresh.md applied to non-security releases, as the 0.159.2 and 0.159.3 moves did. NativeStack2604 already runs 0.160.0.

Host evidence

No files under evidence/hosts/ change.

Checklist

• No new or changed GitHub Actions.
• No secrets printed, logged or committed. gitleaks pre-commit: no leaks.
• No paid hosting or billing surface.
• Peer-owned untracked files and worktrees preserved.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-03T03:40:26.219853Z	511168f	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[seathatflowsinourveins]

Trading-lane acknowledgement requested. This PR changes exactly one trading-owned line: blueprints/us-equities/workers/requirements.txt:1, openai-codex==0.159.3 → ==0.160.0. That follows the shared SDK lock under adoption/sdk/, which tests/test_adoption_contract.py:121-125 binds to the stack's Codex version. No other path under blueprints/us-equities, catalogs/us-equities or catalogs/landscape/us-equities.json changes.

Separately, for the trading owner and not changed here: blueprints/us-equities/workers/README.md:3 still names SDK 0.159.2 as the current example.

The previous move, #580, was acknowledged the same way (comment of 2026-10-01T18:00:03Z).

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 511168f4ae

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[seathatflowsinourveins]

Findings at exact head 511168f, base 56473e4. This is a direct source/artifact read, not a new provider or SDK run.

The pin and marker-canary record is separate from complete role qualification. The public receipt and qualification artifact explicitly use coordinator-supplied qualification facts, with no returned-output hashes or SDK caller exits. The new artifact directory contains only that receipt; its retained-evidence pointer is to the older October1 receipt, whose scope correctly does not qualify0.160.0. No unchanged upstream checks are recorded. Thus I can inspect the declared marker/usage facts and their limitations, but have not independently observed the original0.160 native outputs or the frozen oracle/process record required by acceptance policy.

Please hand off the retained sanitized original command/returned-output locators and hashes, exact managed executable/cwd/version binding, and any original process/SDK return record and discriminating controls that support the claimed native qualification. Original sensitive output can stay private; no credential/auth files are requested. Preserve genuinely missing exits/usage as unknown and label reported metadata accordingly. An artifact map is sufficient for my next bounded original-source read; no repeated model canaries or broad suites are requested by this finding.

The three marker turns do not close the runtime goal's task-worker, researcher, reviewer, builder, MCP/deny and recoverable lifecycle roles. Old0.159.3 role evidence, synthetic0.160 test doubles and the production launcher/daemon still at0.159.3 retain their separate scopes. The runtime owner remains thread01a0ffbf-135b; it is preregistering the two comparisons and continuing the role lane. Requested gateway model/effort and backend observation remain separate as the receipt already says. Trading-owner ACK and fresh-main/hot-file reconciliation remain separate merge gates.

This is a qualification-evidence finding; no whole SDK-lane ACCEPT is issued, and the retained source/installation facts are not discarded. The official pinned source is openai/codex rust-v0.160.0 at a956835d020762cb2b570053af06f643a11c0ecc, sdk/python and supported install/daemon interfaces. Root's native installed client observation still names0.159.3; no host switch is implied by this review.

[seathatflowsinourveins]

Exact-head source/publication verdict for PR626: HEAD ad02af09c9c13f0fa4e8e4d14a356973852f7f04, base dcae68bd08a191f37ba564eceda9fc4a9d6d4a6e.

Consequential trigger: installer/binary provenance and platform verifier repairs. Native requested Astra/max first read3842 returned0 at source bda996cf89eab6a2c9e052e89f3e47f85a79ee9c, with BLOCK solely on inaccessible upstream originals (DNS6), no confirmed P1/P2 code defect. Original5648-byte final SHA256 bc9739632e71ee504859a23a7fc326324551f43f73848aa0de0048f791a641ab stays retained. Root then obtained the official pinned originals through working APIs/native anonymous registry reads, preserving all failures. A separate narrow primary-fact read14383 returned0 and the ACCEPT below at the current merge head. It did not repeat the whole installer or wave2 review.

Current source/registration merge independently verified:81 PR-owned paths, all80 non-registry blobs unchanged; main retirement104 non-registry blobs inherited exactly. Native pinned API reads0; all80 owned bindings match bytes/hash,26updates/54adds/no removals,9383 other main file rows preserved; main187receipts plus branch receipt=188,26convergence paths unchanged. Current registry2517414bytes SHA256 4ee9bd9186440df7c56726e69d4ece98eb87f69cd33e32cafb5c62414cb43762. Current source/receipt bindings. The original isolated bootstrap remains owner evidence with its existing limited profile/time scope; no new bootstrap/model/SDK role run occurred in these reads.

The following is the native narrow followup final, with only its private original-file link replaced by a public-safe locator description. Original2872bytes SHA256 e0ea8177292c08b0593bc2d79faf44242a94f40d3e2604ff4e46877caf569d7e; four read-only native commands0/two processing batches. Separate native counters:84957input/44928cached-subset/5013output/2760reasoning-subset, not summed with the first read or inferred as billing. Requested model/effort remains distinct from actual backend/billing.

ACCEPT for this delta — the sole primary-source evidence-access block is closed. No remaining P1/P2 finding within this scope.

This applies to HEAD ad02af09c9c13f0fa4e8e4d14a356973852f7f04 against base dcae68bd08a191f37ba564eceda9fc4a9d6d4a6e, relying on root’s separate confirmation of the 80 unchanged owned blobs and current integrity.

• The decoded pinned launcher is 8,790 bytes, SHA-256 61b0194f3bb6534439c8d26a3ed57d0805f84b884588b761795323eeb92fcf70, with the expected Git blob. It resolves the platform alias’s package.json, selects its vendor executable, and falls back to wrapper-local vendor only when package resolution fails.
• Actual wrapper registry fields contain exactly six optional aliases, including @openai/codex-linux-x64 → npm:@openai/codex@0.160.0-linux-x64. Both wrapper and platform metadata omit scripts and dependencies; platform metadata also omits optionalDependencies. The tagged package template correctly says 0.0.0-dev; released metadata says 0.160.0.
• npm 11.19.0’s pinned rebuild source confirms the prior installed-source conclusions: ignoreScripts suppresses lifecycle execution while binLinks remains independent; allowScripts denial also preserves bin eligibility. Standalone rebuild defaults to treating optional failures as failures.

Root’s separate observation of the 4,902-byte release archive—three members, matching registry SHA-512, release metadata and byte-identical launcher—completes the package/source binding. This remains a parent observation, not a new upstream test or execution.

All five cache files match preserved native exit-0 stdout plus exactly one newline; cache hashes are not raw-response hashes.

The original BLOCK and failures (private originals retained), including DNS exit 6, remain preserved with 329,574 input / 245,760 cached subset / 14,705 output / 6,481 reasoning subset. Subsets are nonadditive; actual backend, effort and billing remain unknown.

Completeness check: launcher, release binding and npm semantics are covered. Two read-only batches; no network or target execution. Original ownership boundaries, full SDK roles/recovery, hosted macOS CI, trading ACK and native host acceptance remain outside this delta.

Required hosted checks, current trading ACK and fresh owner merge guards still govern landing. Parent source-fetch hook banners were retained and corrected through context-mode; they were not registry JSON or native package executions. No auth/credential files or active client configuration read/copied; no Claude-owned source edited.

[seathatflowsinourveins]

Trading shared scope ACK: PR626 current head

ACK exact head ad02af09c9c13f0fa4e8e4d14a356973852f7f04 for trading shared scope. Root's separate consequential Astra/max source ACCEPT covers installer/security behavior; this bounded read does not repeat that review or execute an installer.

Original Git objects verify both merge parents: final release bda996cf89eab6a2c9e052e89f3e47f85a79ee9c and merged main/#622 dcae68bd08a191f37ba564eceda9fc4a9d6d4a6e. All67 final-release changed nonregistry files preserve their exact blobs in the merge. All104 nonregistry carryover changes and all104 changed registry file rows match main/#622 exactly. Only that already accepted retirement receipt is added; no receipt is deleted and no other registry root field changes. No historical receipt is rewritten by the carryover. Exact source, original merged retirement.

Compared with this lane's prior ACK at511168f4, the only worker-directory difference is README.md. Requirements remain byte-identical at SDK0.160.0; the trading policy, adaptive-paper and engine-nautilus trees are unchanged. The README's last change is A3 3f2d86b3b1adecdd4059b10aa3a9b3c10c070e00; its exact blob survives. Current guide SHA256 bf84fc7f15c3d8a53331e9b36fea43a98b80191195ceadddda64d83280b12b78 /14,924bytes; requirements SHA256 4599ab41626fcd31297ccf485e072c36f495097f98645b58386a712e8d04891c /96bytes. Worker guide, requirements.

The guide correctly separates the upgraded pair's recorded compatibility attempt from historical SDK0.159.2 tool/thread-resume qualification. Missing original invocation/timing remains a limitation; marker compatibility does not qualify upgraded SDK roles, a trading workload, destination profile or paper broker operation. Its pinned upstream source is official Codex SDK a956835d/rust-v0.160.0. This ACK does not infer a fresh installed-client run from repository metadata.

No local tests, installation, native model/provider/broker call, shared-path edit or credential read occurred. Unchanged prior evidence is reused within its original scope. Fresh required checks, exact-head/main/thread guards and the agreed root/Claude/0c merge order still govern merge. Reconsider this ACK if original source changes. Separate Monday paper hold is recorded at PR608#5966340913; no foundation change releases that hold.

[seathatflowsinourveins]

Trading ACK for PR #626 at 75a2ada

Observed 2026-10-03T07:41Z. Scope: source and trading impact only.

Renew the trading ACK for exact head 75a2ada, compared with the previously acknowledged ad02af0 and canonical main e88d59e. The bounded Sol/ultra source inspection found fourteen non-registry main carryovers with matching blobs, plus the Linux test module and its current registry record; it found no trading implementation, adoption recipe, stack selection or historical-receipt change.

The branch-local source delta adds sys and a Linux-only decorator, applied to failed-swap rollback and the Linux-prerequisite class. The exact decorator, rollback use and prerequisite use preserve their Linux assertions and the existing normal-user prerequisite condition. These two scopes skip on non-Linux; this ACK does not promote those skips into cross-platform acceptance. No new flock shim was introduced.

Unchanged worker README SHA256: bf84fc7f15c3d8a53331e9b36fea43a98b80191195ceadddda64d83280b12b78 (14924 bytes). Unchanged worker requirements SHA256: 4599ab41626fcd31297ccf485e072c36f495097f98645b58386a712e8d04891c (96 bytes); the current Codex SDK selection remains 0.160.0. Maintained pinned SDK source remains the reference. All non-file registry roots and retained historical receipts are unchanged; the final branch registration matches the changed test module's actual hash and size.

No new local test, installation, provider/model run, broker request, shared-path edit or credential inspection was performed for this ACK. Required exact-head CI, current-main guards, unresolved-thread checks and the agreed owner merge order still apply. Any later source change requires renewed scope review. Monday's three order-writing timers remain held; this foundation ACK releases no paper gate.

[seathatflowsinourveins]

ACCEPT — source carryover at exact head 75a2ada1eb4db08568b75c5457d2a0b61a949bbb, base e88d59e4b4670ca19211a9ab2adb45e1a28901c7. This supersedes the old-head coverage statement in root’s prior source verdict; its source acceptance carries from ad02af09c9c13f0fa4e8e4d14a356973852f7f04 over this bounded delta.

The branch-owned change adds GNU_ONLY, using sys.platform.startswith("linux"), to exactly the rollback method and the one-method prerequisites class. Their assertions remain unchanged. Those fixtures exercise the Linux installer’s existing GNU mv -T (L314, L782) and flock prerequisite. The skip records that platform scope; it supplies no new macOS execution evidence.

The full tree/registry map shows 81 accepted branch-owned paths: only that test module and the evidence registry differ, with no new branch-owned path. Main #639 contributes15 paths; only the registry overlaps, and the other14 match merged main byte-for-byte. Linux and macOS installers, Linux pins and SDK lock, apply_codex_lane.py, codex_roles.py, and all runtime qualification/evidence records retain their accepted Git blobs. In particular Linux installer blob remains bf763c0bbefbac1377d0e5ee26716554b0e65ad5, macOS installer cd4d268a7e3fffdacc0b0fe23a518d012a21433b, Linux pin file d5875ee95fb4ac2be25f5a05943caa07a50aa791, SDK lock aac95da992b63e423b72f1017fa92a077e2e586f, launcher b4a2c2eb3384004850f0546ab37be7c2eece7214, and roles module 791aaa78c3b98235275a31053be4c18928bd697a. The already-reviewed Codex0.160/native launcher and upstream source pin acceptance remains scoped to the prior verdict’s citations.

The registry is current main plus the accepted owned delta and the changed test binding, with zero missing/unexpected/mismatched entries. It preserves9,387 peer file rows,187 peer receipts and26 convergence records in exact value/order. The updated test row binds28,940 bytes/SHA256 702f81f588772fdfd0e8246e7a00efddadce765a5c390fdbd7df675ede502ec8.

Native source observations and bounded map/dependency commands exited0; exact-head readback confirms75a2/basee88. Original API responses and map output remain retained with the source worker’s custody keys and this root receipt. No tests, provider run, native installation or SDK qualification were rerun. This ACCEPT covers the source delta and evidence preservation, not complete SDK role/cost/recovery/cancellation/restoration qualification or current CI. The owner’s merge slot after #637, required checks and exact lane:shared protocol still apply.

[seathatflowsinourveins]

Claude session native-agent-stack-5f: head a1a5488e52c52ed2b1000d3d074e4efcad66d652 refreshes this PR onto main e7c297e255c98337b54ff3d514191d5d1fa36354. The landing check prints LANDABLE against that main. The real CodexIntegrationTests pass against codex-cli 0.160.0 at this head.

Commits. Pushed normally as 36d45155..a1a5488e, with no force-push and no rebase.

1. 2204cce8 merges main e7c297e2, which is 20 commits after 1f5a791b (through K4 timing test: time check() with the cyclic collector off, as timeit does (CI flake on #651, #660) #665). Its parents are 36d45155 and e7c297e2; its tree is d7f79d23.
2. 6af145ab sets manifests/stack.json, manifests/evidence.json and observability/grand-dashboard/state.json to main's copies, per the hot-file protocol. Its tree is f7460a86.
3. a1a5488e restores this branch's copies, so all three are in the last commit. Its tree is d7f79d23, the merge commit's tree.

Main has since moved to fdd0a247. This head was not merged again, and every check below is against e7c297e2.

How each conflict was resolved. The merge conflicted in four files, all of them expected. docs/new-wsl-handbook.json merged cleanly, but it was regenerated together with the md.

• .gitattributes. Both sides are kept. Main's codex-client-check-20261003.txt -whitespace entry comes first, then this PR's two exec-help entries at the end. This PR's change against main therefore stays a pure append. The patterns name different files, so none repeats or contradicts another.
• Handbook. I took main's docs/new-wsl-handbook.{md,json} and handbook receipt (Wave-2 phase-0 records: X17 interim installs, install plan, client-configuration map and templates, skills, K4 guard and handbook #659) as the base, then ran python3 scripts/build_new_wsl_handbook.py --write. Neither handbook file was edited by hand.
  • In the receipt, profile_sha256 and the two outputs hashes now follow this PR's profile and the regenerated files. Nothing else in the receipt changed.
  • generator_sha256 stays at main's a78239b6…. That is the hash of the generator, which this PR does not change.
• Registry. I took main's manifests/evidence.json and appended this PR's receipts[] row runtime-sdk-20261003, unchanged from 36d45155.
  • python3 scripts/new_host_grand_list.py --write re-registered its two outputs. Its --check passed before the write, so their content did not change.
  • host_receipts.register_file re-registered this PR's other 85 files from the merged tree.
  • Main's other 9,658 rows are unchanged and stay in main's order. convergence_records equals main's.
• stack.json and state.json. Main has changed neither since 1f5a791b, so this PR's copies stand. The state.json diff against main is the one shown in round 4.

(a) Mechanical refresh check, 36d45155 → a1a5488e

I compared each head's PR diff against its own merge base: 1f5a791b before, e7c297e2 after.

• Owned paths. The PR owns 88 paths before and 88 after, the same set. git patch-id --stable is identical for 84 of them. Four differ:
  1. .gitattributes. Context only. The four added lines are identical, and the lines before them are now main's new entry.
  2. docs/new-wsl-handbook.md. Context only. The 12 changed lines are identical, and Wave-2 phase-0 records: X17 interim installs, install plan, client-configuration map and templates, skills, K4 guard and handbook #659's regeneration changed the lines around them.
  3. evidence/artifacts/new-wsl-handbook-20261001/receipt.json. The profile_sha256 change is identical (1e08ba8e… → 160d8551…). The two outputs lines changed:
     • before: from 974e78af…/3e9ad2be… to 4728b018…/b124bd55…;
     • now: from main's Wave-2 phase-0 records: X17 interim installs, install plan, client-configuration map and templates, skills, K4 guard and handbook #659 values (c54dd6ff…, c28e1c48…) to the regenerated values (93682c25…, 73fff09e…).
  4. manifests/evidence.json. The registry merge; see the row check below.
• docs/new-wsl-handbook.json. Its patch-id is identical: the same 38 changed lines in the same context.
• Owned registry rows. There are 87 before and 87 after, with the same paths. The values differ only in nine rehashes, for the files that both this PR and main changed:

Row	36d45155	a1a5488e
.gitattributes	bf64b1766971…, 855 B	b056917f02d4…, 1,123 B
adoption/platforms/macos-arm64.md	afe35db07045…, 63,262 B	07f57a25f609…, 64,072 B
docs/new-wsl-handbook.json	4728b0184183…, 537,182 B	93682c255f4c…, 561,055 B
docs/new-wsl-handbook.md	b124bd55d65d…, 320,267 B	73fff09e4c2d…, 323,968 B
evidence/artifacts/new-wsl-handbook-20261001/receipt.json	a68b7a3cc7bd…, 4,174 B	e7154e3e62c3…, 4,174 B
recipes/README.md	fda04fef73bc…, 125,306 B	94ccf5e86f0a…, 126,072 B
tests/test_adoption_bootstrap_macos.py	d142da3da639…, 228,055 B	a085835f7fdf…, 228,690 B
tests/test_codex_worker_lane.py	3ba0ee57cacb…, 155,359 B	b044dbd84257…, 155,728 B
tests/test_render_config.py	a6145567f5bc…, 43,257 B	e8a7d735d730…, 45,406 B

• Receipts and convergence records. The PR's own receipts[] row (runtime-sdk-20261003) is unchanged. The PR leaves convergence_records untouched, before and after.

• Integration-test inputs. Main changed these Codex-lane paths after 1f5a791b:

  • adoption/templates/codex.AGENTS.template.md and codex.config.template.toml;
  • adoption/agents/codex/workers/SHA256SUMS and semantic-evidence-reviewer.toml;
  • tests/test_codex_worker_lane.py;
  • tools/adoption/codex_home.py, install_skills.py and new_wsl_client_config.py.

  The real CodexIntegrationTests were therefore run again at this head; see (c).

(b) For the configuration owner's per-PR read: the exact handbook and receipt diff against main e7c297e2

The two handbook files come from --write with no hand edits. In the receipt, the three hashes are a hand edit, and nothing else changed. The json and md +/- lines are byte-identical to those in round 4's diff against 1f5a791b.

diff --git a/docs/new-wsl-handbook.json b/docs/new-wsl-handbook.json
index 74a41ae7c..8c2afd0b3 100644
--- a/docs/new-wsl-handbook.json
+++ b/docs/new-wsl-handbook.json
@@ -6828,7 +6828,7 @@
     },
     {
       "path": "adoption/new-wsl-profile.json",
-      "sha256": "1e08ba8e879b0c52fd5c53341ea60bb27ca70ebc64cb9af655d9ba5ae0a21cb0"
+      "sha256": "160d85512e237a2d2f65de752aed86dd1f4da8633fc77feb35324e7c4499d028"
     },
     {
       "path": "adoption/platforms/linux-wsl2-new-distro.md",
@@ -7154,8 +7154,8 @@
       "checksum": {
         "algorithm": "sha256",
         "kind": "artifact",
-        "source": "https://registry.npmjs.org/%40openai%2Fcodex/0.159.3",
-        "value": "31d5e584e93e118dd37dbb8bc89ddbbe9998178fc437dc0b9d0f7cc72ef0cf79"
+        "source": "https://registry.npmjs.org/%40openai%2Fcodex/0.160.0",
+        "value": "373517768e912eeb5054024ae9215e2c90a1420957b66fe134ef745a00948d4a"
       },
       "documented_install": [
         {
@@ -7172,16 +7172,17 @@
         "evidence/artifacts/new-wsl-clean-install-selection-20261001/selection.json",
         "evidence/artifacts/new-wsl-clean-install-selection-20261001/packets/native-clients.json",
         "evidence/artifacts/new-wsl-profile-20261001/source-review.json",
-        "https://github.com/openai/codex/blob/rust-v0.159.3/README.md",
+        "https://github.com/openai/codex/blob/rust-v0.160.0/README.md",
         "https://developers.openai.com/codex/noninteractive",
-        "evidence/artifacts/new-wsl-profile-20261001/upstream-gap-closure.json"
+        "evidence/artifacts/new-wsl-profile-20261001/upstream-gap-closure.json",
+        "evidence/artifacts/runtime-sdk-20261003/receipt.json"
       ],
       "install": {
-        "command": "npm install -g @openai/codex@0.159.3",
+        "command": "npm install -g @openai/codex@0.160.0",
         "execution_status": "UNRUN",
         "pinning_source": "https://docs.npmjs.com/cli/v11/commands/npm-install",
         "scope": "Upstream npm install form with the accepted package version supplied using npm documented version syntax. This is a reviewed example; the selected bootstrap keeps its existing isolated-prefix installation path.",
-        "source": "https://github.com/openai/codex/blob/rust-v0.159.3/README.md"
+        "source": "https://github.com/openai/codex/blob/rust-v0.160.0/README.md"
       },
       "name": "Codex",
       "native_update": {
@@ -7193,7 +7194,7 @@
         "order": "It runs after the bootstrap has installed the pin and before this client's acceptance command.",
         "receipt_fields": {
           "acceptance_result_on_that_version": "The result of this entry's acceptance command on that version.",
-          "floor": "The pin of this entry, 0.159.3: the release the bootstrap installs.",
+          "floor": "The pin of this entry, 0.160.0: the release the bootstrap installs.",
           "version_after_native_update": "The version that PATH resolves to after the native update, or after the updater's refusal."
         },
         "sources": [
@@ -7203,7 +7204,7 @@
       "owner_layer_id": "native-clients",
       "ownership_source": "evidence/artifacts/new-wsl-clean-install-selection-20261001/ownership.json",
       "package_id": "npm:@openai/codex",
-      "pin": "0.159.3",
+      "pin": "0.160.0",
       "position": 1,
       "provisioning_status": "unprovisioned_source_review",
       "repository": "https://github.com/openai/codex",
@@ -11041,7 +11042,7 @@
           "Existing authorized native Codex authentication and the intended repository context."
         ],
         "scope": "The Python body is the unchanged upstream quickstart; the here-document is only its shell carrier. No SDK/provider/model execution or output-quality acceptance occurred.",
-        "source": "https://github.com/openai/codex/blob/rust-v0.159.3/sdk/python/README.md#quickstart"
+        "source": "https://github.com/openai/codex/blob/rust-v0.160.0/sdk/python/README.md#quickstart"
       },
       "aliases": [
         "Codex Python SDK"
@@ -11050,8 +11051,8 @@
       "checksum": {
         "algorithm": "sha256",
         "kind": "artifact",
-        "source": "https://pypi.org/pypi/openai-codex/0.159.3/json",
-        "value": "5148065fb13cfb3f106c6493f3a5dc26457da98f6350e193e85eda8b65263b8f"
+        "source": "https://pypi.org/pypi/openai-codex/0.160.0/json",
+        "value": "61d2d855ca2ebedfd51280fbeb60ff31fc47ccbd55ebce186505e3f3da096921"
       },
       "documented_install": [],
       "evidence_refs": [
@@ -11059,22 +11060,23 @@
         "evidence/artifacts/new-wsl-clean-install-selection-20261001/selection.json",
         "evidence/artifacts/new-wsl-clean-install-selection-20261001/packets/agent-sdks.json",
         "evidence/artifacts/new-wsl-profile-20261001/source-review.json",
-        "https://github.com/openai/codex/blob/rust-v0.159.3/sdk/python/README.md",
-        "evidence/artifacts/new-wsl-profile-20261001/upstream-gap-closure.json"
+        "https://github.com/openai/codex/blob/rust-v0.160.0/sdk/python/README.md",
+        "evidence/artifacts/new-wsl-profile-20261001/upstream-gap-closure.json",
+        "evidence/artifacts/runtime-sdk-20261003/receipt.json"
       ],
       "install": {
-        "command": "python -m pip install openai-codex==0.159.3",
+        "command": "python -m pip install openai-codex==0.160.0",
         "execution_status": "UNRUN",
-        "package_source": "https://pypi.org/pypi/openai-codex/0.159.3/json",
+        "package_source": "https://pypi.org/pypi/openai-codex/0.160.0/json",
         "pinning_source": "https://pip.pypa.io/en/stable/cli/pip_install/",
         "scope": "Upstream package installed using pip documented module invocation and exact version syntax; run in the owned Python environment, never the OS Python.",
-        "source": "https://github.com/openai/codex/blob/rust-v0.159.3/sdk/python/README.md"
+        "source": "https://github.com/openai/codex/blob/rust-v0.160.0/sdk/python/README.md"
       },
       "name": "Codex Python SDK",
       "owner_layer_id": "agent-sdks",
       "ownership_source": "evidence/artifacts/new-wsl-clean-install-selection-20261001/ownership.json",
       "package_id": "pypi:openai-codex",
-      "pin": "0.159.3",
+      "pin": "0.160.0",
       "position": 3,
       "provisioning_status": "unprovisioned_source_review",
       "repository": "https://github.com/openai/codex",
diff --git a/docs/new-wsl-handbook.md b/docs/new-wsl-handbook.md
index ae942df89..e362267fe 100644
--- a/docs/new-wsl-handbook.md
+++ b/docs/new-wsl-handbook.md
@@ -197,7 +197,7 @@ Default ownership: ["Claude Code", "Codex"]; uses: [].
 | Tool / repository | Owner / status | Pin / checksum | Install | Acceptance | Stage / position |
 | --- | --- | --- | --- | --- | --- |
 | [Claude Code](https://github.com/anthropics/claude-code) | native-clients / picked | 2.1.284 / {"algorithm": "sha256", "kind": "artifact", "source": "https://downloads.claude.ai/claude-code-releases/2.1.284/manifest.json", "value": "5cd90aabd83f8a15136c35aa37bb1d92b348993573316643dc3fe4e04afbf88f"} | {"command": "curl -fsSL https://claude.ai/install.sh \| bash -s 2.1.284", "execution_status": "UNRUN", "scope": "The documented specific-version form with the accepted pin as its operand: the floor that the selected bootstrap installs through the native binary's own `install <version>`. The bootstrap keeps a newer existing install instead of downgrading it. This is a reviewed example; the move to the current release is the native update below.", "source": "https://code.claude.com/docs/en/setup#install-a-specific-version"} | {"command": "claude -p \"explain this function\"", "evidence_class": "documented_upstream_example_not_executed", "execution_status": "UNRUN", "prerequisites": ["Claude Code at or above the 2.1.284 floor installed, with its installed version recorded in the receipt.", "Existing authorized native sign-in and actual function/project context sufficient to answer the example."], "scope": "Official one-off query example. A prompt without actual function context is not a functional oracle. Host 2.1.287 is above the 2.1.284 floor and counts as installed; acceptance has not passed on that host. No model request occurred.", "source": "https://code.claude.com/docs/en/quickstart#essential-commands"} | native-clients / 2 |
-| [Codex](https://github.com/openai/codex) (`npm:@openai/codex`) | native-clients / picked | 0.159.3 / {"algorithm": "sha256", "kind": "artifact", "source": "https://registry.npmjs.org/%40openai%2Fcodex/0.159.3", "value": "31d5e584e93e118dd37dbb8bc89ddbbe9998178fc437dc0b9d0f7cc72ef0cf79"} | {"command": "npm install -g @openai/codex@0.159.3", "execution_status": "UNRUN", "pinning_source": "https://docs.npmjs.com/cli/v11/commands/npm-install", "scope": "Upstream npm install form with the accepted package version supplied using npm documented version syntax. This is a reviewed example; the selected bootstrap keeps its existing isolated-prefix installation path.", "source": "https://github.com/openai/codex/blob/rust-v0.159.3/README.md"} | {"command": "codex exec \"summarize the repository structure and list the top 5 risky areas\"", "evidence_class": "documented_upstream_example_not_executed", "execution_status": "UNRUN", "prerequisites": ["Selected Codex CLI and its native platform dependency installed.", "Existing authorized native sign-in and the intended repository context."], "scope": "Official noninteractive example. No model request, result-quality assessment, account activation or destination-host execution occurred.", "source": "https://developers.openai.com/codex/noninteractive"} | native-clients / 1 |
+| [Codex](https://github.com/openai/codex) (`npm:@openai/codex`) | native-clients / picked | 0.160.0 / {"algorithm": "sha256", "kind": "artifact", "source": "https://registry.npmjs.org/%40openai%2Fcodex/0.160.0", "value": "373517768e912eeb5054024ae9215e2c90a1420957b66fe134ef745a00948d4a"} | {"command": "npm install -g @openai/codex@0.160.0", "execution_status": "UNRUN", "pinning_source": "https://docs.npmjs.com/cli/v11/commands/npm-install", "scope": "Upstream npm install form with the accepted package version supplied using npm documented version syntax. This is a reviewed example; the selected bootstrap keeps its existing isolated-prefix installation path.", "source": "https://github.com/openai/codex/blob/rust-v0.160.0/README.md"} | {"command": "codex exec \"summarize the repository structure and list the top 5 risky areas\"", "evidence_class": "documented_upstream_example_not_executed", "execution_status": "UNRUN", "prerequisites": ["Selected Codex CLI and its native platform dependency installed.", "Existing authorized native sign-in and the intended repository context."], "scope": "Official noninteractive example. No model request, result-quality assessment, account activation or destination-host execution occurred.", "source": "https://developers.openai.com/codex/noninteractive"} | native-clients / 1 |
 
 - claude verdict: pending; pending.
 - codex verdict: pending; pending.
@@ -219,7 +219,7 @@ Reference edition: [catalogs/foundation/new-wsl-architecture-20261001.json](../c
 - Claude Code receipt field acceptance_result_on_that_version: The result of this entry's acceptance command on that version.
 - Claude Code packet install reference (not a pinned recipe): [{"command": "curl -fsSL https://claude.ai/install.sh \| bash", "source": "https://code.claude.com/docs/en/setup (setup.md lines 40-43, tab 'macOS, Linux, WSL'; read 2026-10-01)"}, {"command": "curl -fsSL https://claude.ai/install.sh \| bash", "source": "https://github.com/anthropics/claude-code/blob/main/README.md"}]
 - Codex native update: `codex update`, UNRUN. `codex update --help` on codex-cli 0.159.3 prints: Update Codex to the latest version. It runs after the bootstrap has installed the pin and before this client's acceptance command. An updater that refuses is recorded with its error and the version actually on PATH. The anti-pattern log of docs/harness-defaults.md records that `codex update` did not establish that a versioned launcher's target had changed, so the version that PATH resolves to is read after the update and never assumed from it. The acceptance command then runs on the version that results. A release newer than the pin counts as installed and not yet qualified until that acceptance has passed on that host. Sources: [docs/harness-defaults.md](../docs/harness-defaults.md).
-- Codex receipt field floor: The pin of this entry, 0.159.3: the release the bootstrap installs.
+- Codex receipt field floor: The pin of this entry, 0.160.0: the release the bootstrap installs.
 - Codex receipt field version_after_native_update: The version that PATH resolves to after the native update, or after the updater's refusal.
 - Codex receipt field acceptance_result_on_that_version: The result of this entry's acceptance command on that version.
 - Codex packet install reference (not a pinned recipe): [{"command": "npm install -g @openai/codex", "source": "https://github.com/openai/codex/blob/main/README.md line 42 (macOS alternative: brew install --cask codex, line 47); read 2026-10-01"}, {"command": "curl -fsSL https://chatgpt.com/codex/install.sh \| sh", "source": "https://github.com/openai/codex/blob/main/README.md"}]
@@ -299,7 +299,7 @@ Default ownership: []; uses: ["the native subagents of Claude Code and Codex (na
 | Tool / repository | Owner / status | Pin / checksum | Install | Acceptance | Stage / position |
 | --- | --- | --- | --- | --- | --- |
 | [Claude Code](https://github.com/anthropics/claude-code) | native-clients / picked | 2.1.284 / {"algorithm": "sha256", "kind": "artifact", "source": "https://downloads.claude.ai/claude-code-releases/2.1.284/manifest.json", "value": "5cd90aabd83f8a15136c35aa37bb1d92b348993573316643dc3fe4e04afbf88f"} | {"command": "curl -fsSL https://claude.ai/install.sh \| bash -s 2.1.284", "execution_status": "UNRUN", "scope": "The documented specific-version form with the accepted pin as its operand: the floor that the selected bootstrap installs through the native binary's own `install <version>`. The bootstrap keeps a newer existing install instead of downgrading it. This is a reviewed example; the move to the current release is the native update below.", "source": "https://code.claude.com/docs/en/setup#install-a-specific-version"} | {"command": "claude -p \"explain this function\"", "evidence_class": "documented_upstream_example_not_executed", "execution_status": "UNRUN", "prerequisites": ["Claude Code at or above the 2.1.284 floor installed, with its installed version recorded in the receipt.", "Existing authorized native sign-in and actual function/project context sufficient to answer the example."], "scope": "Official one-off query example. A prompt without actual function context is not a functional oracle. Host 2.1.287 is above the 2.1.284 floor and counts as installed; acceptance has not passed on that host. No model request occurred.", "source": "https://code.claude.com/docs/en/quickstart#essential-commands"} | native-clients / 2 |
-| [Codex](https://github.com/openai/codex) (`npm:@openai/codex`) | native-clients / picked | 0.159.3 / {"algorithm": "sha256", "kind": "artifact", "source": "https://registry.npmjs.org/%40openai%2Fcodex/0.159.3", "value": "31d5e584e93e118dd37dbb8bc89ddbbe9998178fc437dc0b9d0f7cc72ef0cf79"} | {"command": "npm install -g @openai/codex@0.159.3", "execution_status": "UNRUN", "pinning_source": "https://docs.npmjs.com/cli/v11/commands/npm-install", "scope": "Upstream npm install form with the accepted package version supplied using npm documented version syntax. This is a reviewed example; the selected bootstrap keeps its existing isolated-prefix installation path.", "source": "https://github.com/openai/codex/blob/rust-v0.159.3/README.md"} | {"command": "codex exec \"summarize the repository structure and list the top 5 risky areas\"", "evidence_class": "documented_upstream_example_not_executed", "execution_status": "UNRUN", "prerequisites": ["Selected Codex CLI and its native platform dependency installed.", "Existing authorized native sign-in and the intended repository context."], "scope": "Official noninteractive example. No model request, result-quality assessment, account activation or destination-host execution occurred.", "source": "https://developers.openai.com/codex/noninteractive"} | native-clients / 1 |
+| [Codex](https://github.com/openai/codex) (`npm:@openai/codex`) | native-clients / picked | 0.160.0 / {"algorithm": "sha256", "kind": "artifact", "source": "https://registry.npmjs.org/%40openai%2Fcodex/0.160.0", "value": "373517768e912eeb5054024ae9215e2c90a1420957b66fe134ef745a00948d4a"} | {"command": "npm install -g @openai/codex@0.160.0", "execution_status": "UNRUN", "pinning_source": "https://docs.npmjs.com/cli/v11/commands/npm-install", "scope": "Upstream npm install form with the accepted package version supplied using npm documented version syntax. This is a reviewed example; the selected bootstrap keeps its existing isolated-prefix installation path.", "source": "https://github.com/openai/codex/blob/rust-v0.160.0/README.md"} | {"command": "codex exec \"summarize the repository structure and list the top 5 risky areas\"", "evidence_class": "documented_upstream_example_not_executed", "execution_status": "UNRUN", "prerequisites": ["Selected Codex CLI and its native platform dependency installed.", "Existing authorized native sign-in and the intended repository context."], "scope": "Official noninteractive example. No model request, result-quality assessment, account activation or destination-host execution occurred.", "source": "https://developers.openai.com/codex/noninteractive"} | native-clients / 1 |
 | [Worktrunk](https://github.com/max-sixty/worktrunk) | git-github-automation / picked | 0.80.0 / {"algorithm": "sha256", "kind": "artifact", "source": "https://api.github.com/repos/max-sixty/worktrunk/releases/tags/v0.80.0", "value": "532ce3ed5eecb1be274c925b5887f61671e2434a4ca2561b9a8ac9379dbba199"} | {"command": "curl --proto '=https' --tlsv1.2 -LsSf https://github.com/max-sixty/worktrunk/releases/download/v0.80.0/worktrunk-installer.sh \| sh && wt config shell install", "execution_status": "UNRUN", "scope": "Exact versioned release-installer command including upstream wt config shell install. This writes shell integration when executed; no installer or shell mutation was run.", "source": "https://github.com/max-sixty/worktrunk/releases/tag/v0.80.0"} | {"command": "cargo test", "evidence_class": "upstream_test_command_not_executed", "execution_status": "UNRUN", "prerequisites": ["Selected upstream source checkout and Rust build/test dependencies."], "scope": "README default cargo test unit suite only; shell integration has a separate feature-enabled suite requiring bash, zsh, fish, nushell, pwsh and jq. No shell integration was qualified. The observed host release 0.79.0 is below the selected release 0.80.0; acceptance is owed on the new host.", "source": "https://github.com/max-sixty/worktrunk/blob/b49ca7eea9b03145791a5b94eccaf9c59412ed37/README.md"} | native-extensions / 4 |
 
 - claude verdict: pending; pending.
@@ -322,7 +322,7 @@ Reference edition: [catalogs/foundation/new-wsl-architecture-20261001.json](../c
 - Claude Code receipt field acceptance_result_on_that_version: The result of this entry's acceptance command on that version.
 - Claude Code packet install reference (not a pinned recipe): [{"command": "curl -fsSL https://claude.ai/install.sh \| bash", "source": "https://code.claude.com/docs/en/setup (setup.md lines 40-43, tab 'macOS, Linux, WSL'; read 2026-10-01)"}, {"command": "curl -fsSL https://claude.ai/install.sh \| bash", "source": "https://github.com/anthropics/claude-code/blob/main/README.md"}]
 - Codex native update: `codex update`, UNRUN. `codex update --help` on codex-cli 0.159.3 prints: Update Codex to the latest version. It runs after the bootstrap has installed the pin and before this client's acceptance command. An updater that refuses is recorded with its error and the version actually on PATH. The anti-pattern log of docs/harness-defaults.md records that `codex update` did not establish that a versioned launcher's target had changed, so the version that PATH resolves to is read after the update and never assumed from it. The acceptance command then runs on the version that results. A release newer than the pin counts as installed and not yet qualified until that acceptance has passed on that host. Sources: [docs/harness-defaults.md](../docs/harness-defaults.md).
-- Codex receipt field floor: The pin of this entry, 0.159.3: the release the bootstrap installs.
+- Codex receipt field floor: The pin of this entry, 0.160.0: the release the bootstrap installs.
 - Codex receipt field version_after_native_update: The version that PATH resolves to after the native update, or after the updater's refusal.
 - Codex receipt field acceptance_result_on_that_version: The result of this entry's acceptance command on that version.
 - Codex packet install reference (not a pinned recipe): [{"command": "npm install -g @openai/codex", "source": "https://github.com/openai/codex/blob/main/README.md line 42 (macOS alternative: brew install --cask codex, line 47); read 2026-10-01"}, {"command": "curl -fsSL https://chatgpt.com/codex/install.sh \| sh", "source": "https://github.com/openai/codex/blob/main/README.md"}]
@@ -1163,7 +1163,7 @@ Default ownership: ["Claude Agent SDK", "Codex SDK and codex exec/app-server"];
 | [Claude Agent SDK](https://github.com/anthropics/claude-agent-sdk-python) (`pypi:claude-agent-sdk`) | agent-sdks / picked | 0.2.163 / {"algorithm": "sha256", "kind": "artifact", "source": "https://pypi.org/pypi/claude-agent-sdk/0.2.163/json", "value": "269821ad5acff5967522ff15f444b0598840fd9bdc45c645de569a5478061a53"} | {"command": "pip install claude-agent-sdk==0.2.163", "execution_status": "UNRUN", "prerequisites": ["Owned Python environment and pip for claude-agent-sdk 0.2.163."], "source": "https://github.com/anthropics/claude-agent-sdk-python/blob/v0.2.163/README.md", "source_review_ref": "evidence/artifacts/new-wsl-profile-20261001/core-native-recipe-wave-1.json"} | {"command": "pip install -e \".[dev]\" && python -m pytest tests/ -v --cov=claude_agent_sdk --cov-report=xml", "evidence_class": "upstream_test_command_not_executed", "execution_status": "UNRUN", "prerequisites": ["Run from the v0.2.163 source checkout in the upstream Python test environment with its development extras.", "This selects tests/, not the separate authenticated e2e-tests/ workflow."], "scope": "Unchanged upstream source tests; no native sign-in, authenticated SDK turn, provider or new-host acceptance.", "source": "https://github.com/anthropics/claude-agent-sdk-python/blob/v0.2.163/.github/workflows/test.yml", "source_review_ref": "evidence/artifacts/new-wsl-profile-20261001/core-native-recipe-wave-1.json"} | sdk-source-review / 1 |
 | [Codex SDK and codex exec/app-server](https://github.com/openai/codex) | agent-sdks / picked | pending / pending | pending | pending | None / None |
 | [Codex TypeScript SDK](https://github.com/openai/codex) (`npm:@openai/codex-sdk`) | agent-sdks / picked | 0.159.3 / {"algorithm": "sha256", "kind": "artifact", "source": "https://registry.npmjs.org/%40openai%2Fcodex-sdk/0.159.3", "value": "f10a967cab205ad7875bd2cd8c508ccc5ab9501ff900f9466378e1b0e14b0522"} | {"command": "npm install @openai/codex-sdk@0.159.3", "execution_status": "UNRUN", "pinning_source": "https://docs.npmjs.com/cli/v11/commands/npm-install", "prerequisites": ["Owned Node/npm project environment for @openai/codex-sdk 0.159.3."], "scope": "Reviewed upstream package-manager form with the verified package release supplied as its explicit version.", "source": "https://github.com/openai/codex/blob/rust-v0.159.3/sdk/typescript/README.md", "source_review_ref": "evidence/artifacts/new-wsl-profile-20261001/core-native-recipe-wave-1.json"} | {"command": "pnpm install --frozen-lockfile && pnpm -r --filter ./sdk/typescript run build && pnpm -r --filter ./sdk/typescript run test", "evidence_class": "upstream_test_command_not_executed", "execution_status": "UNRUN", "prerequisites": ["Run from the rust-v0.159.3 repository root with the workflow's pnpm setup and Node.js 22.", "Complete the selected workflow's Bazel preparation and build //codex-rs/cli:codex plus //codex-rs/code-mode-host:codex-code-mode-host. Stage both matching binaries together and set CODEX_EXEC_PATH to that CLI as the workflow specifies; no environment or credential values were read here.", "The recorded install/build/test steps omit the separate lint step and do not reproduce the whole CI job."], "scope": "Upstream SDK source test workflow with its matching CLI/code-mode-host prerequisites; no live provider/sign-in or new-host result. Python SDK qualification does not qualify this TypeScript SDK.", "source": "https://github.com/openai/codex/blob/rust-v0.159.3/.github/workflows/sdk.yml#L126", "source_review_ref": "evidence/artifacts/new-wsl-profile-20261001/core-native-recipe-wave-1.json"} | sdk-source-review / 2 |
-| [Codex Python SDK](https://github.com/openai/codex) (`pypi:openai-codex`) | agent-sdks / picked | 0.159.3 / {"algorithm": "sha256", "kind": "artifact", "source": "https://pypi.org/pypi/openai-codex/0.159.3/json", "value": "5148065fb13cfb3f106c6493f3a5dc26457da98f6350e193e85eda8b65263b8f"} | {"command": "python -m pip install openai-codex==0.159.3", "execution_status": "UNRUN", "package_source": "https://pypi.org/pypi/openai-codex/0.159.3/json", "pinning_source": "https://pip.pypa.io/en/stable/cli/pip_install/", "scope": "Upstream package installed using pip documented module invocation and exact version syntax; run in the owned Python environment, never the OS Python.", "source": "https://github.com/openai/codex/blob/rust-v0.159.3/sdk/python/README.md"} | {"command": "python - <<'PY'\nfrom openai_codex import Codex\n\nwith Codex() as codex:\n    thread = codex.thread_start()\n    result = thread.run(\"Explain this repository in three bullets.\")\n    print(result.final_response)\nPY", "evidence_class": "documented_upstream_example_not_executed", "execution_status": "UNRUN", "prerequisites": ["Owned Python environment with the selected SDK and its native CLI dependency installed.", "Existing authorized native Codex authentication and the intended repository context."], "scope": "The Python body is the unchanged upstream quickstart; the here-document is only its shell carrier. No SDK/provider/model execution or output-quality acceptance occurred.", "source": "https://github.com/openai/codex/blob/rust-v0.159.3/sdk/python/README.md#quickstart"} | sdk-source-review / 3 |
+| [Codex Python SDK](https://github.com/openai/codex) (`pypi:openai-codex`) | agent-sdks / picked | 0.160.0 / {"algorithm": "sha256", "kind": "artifact", "source": "https://pypi.org/pypi/openai-codex/0.160.0/json", "value": "61d2d855ca2ebedfd51280fbeb60ff31fc47ccbd55ebce186505e3f3da096921"} | {"command": "python -m pip install openai-codex==0.160.0", "execution_status": "UNRUN", "package_source": "https://pypi.org/pypi/openai-codex/0.160.0/json", "pinning_source": "https://pip.pypa.io/en/stable/cli/pip_install/", "scope": "Upstream package installed using pip documented module invocation and exact version syntax; run in the owned Python environment, never the OS Python.", "source": "https://github.com/openai/codex/blob/rust-v0.160.0/sdk/python/README.md"} | {"command": "python - <<'PY'\nfrom openai_codex import Codex\n\nwith Codex() as codex:\n    thread = codex.thread_start()\n    result = thread.run(\"Explain this repository in three bullets.\")\n    print(result.final_response)\nPY", "evidence_class": "documented_upstream_example_not_executed", "execution_status": "UNRUN", "prerequisites": ["Owned Python environment with the selected SDK and its native CLI dependency installed.", "Existing authorized native Codex authentication and the intended repository context."], "scope": "The Python body is the unchanged upstream quickstart; the here-document is only its shell carrier. No SDK/provider/model execution or output-quality acceptance occurred.", "source": "https://github.com/openai/codex/blob/rust-v0.160.0/sdk/python/README.md#quickstart"} | sdk-source-review / 3 |
 
 - claude verdict: pending; pending.
 - codex verdict: pending; pending.
@@ -2101,7 +2101,7 @@ Reference edition: [catalogs/foundation/new-wsl-architecture-20261001.json](../c
 | Repository source | SHA-256 |
 | --- | --- |
 | [adoption/manifest.json](../adoption/manifest.json) | `7bb179e8440be17b75484c21495e66385ea8eb959a491d43d2488056ddede09a` |
-| [adoption/new-wsl-profile.json](../adoption/new-wsl-profile.json) | `1e08ba8e879b0c52fd5c53341ea60bb27ca70ebc64cb9af655d9ba5ae0a21cb0` |
+| [adoption/new-wsl-profile.json](../adoption/new-wsl-profile.json) | `160d85512e237a2d2f65de752aed86dd1f4da8633fc77feb35324e7c4499d028` |
 | [adoption/platforms/linux-wsl2-new-distro.md](../adoption/platforms/linux-wsl2-new-distro.md) | `7fdb79e02c0a2a670bc59e6ad86d4fe43132b93fb003763c1ce4e983505e23f4` |
 | [catalogs/foundation/new-wsl-architecture-20261001.json](../catalogs/foundation/new-wsl-architecture-20261001.json) | `84c65a395145efe884a70b561205a3359b2b21022bd6fd4107d35d18016efdf6` |
 | [catalogs/landscape/research-state.json](../catalogs/landscape/research-state.json) | `f47edec17a486e4e3de14bc2e3ef3a6224f3cf09b3830cb336b16bc6480050e1` |
diff --git a/evidence/artifacts/new-wsl-handbook-20261001/receipt.json b/evidence/artifacts/new-wsl-handbook-20261001/receipt.json
index 3c7b31a5a..cf5eccf4d 100644
--- a/evidence/artifacts/new-wsl-handbook-20261001/receipt.json
+++ b/evidence/artifacts/new-wsl-handbook-20261001/receipt.json
@@ -4,10 +4,10 @@
   "source_main": "85543efe5abcddb7b7cddb14e8774e83b6758616",
   "evidence_class": "local_integration",
   "generator_sha256": "a78239b6a2558c916b30f4cbc852fe948904a849e99ae37cfadc1c810a6df20e",
-  "profile_sha256": "1e08ba8e879b0c52fd5c53341ea60bb27ca70ebc64cb9af655d9ba5ae0a21cb0",
+  "profile_sha256": "160d85512e237a2d2f65de752aed86dd1f4da8633fc77feb35324e7c4499d028",
   "outputs": {
-    "docs/new-wsl-handbook.json": "c54dd6ff904dcd699798e87a4c374d47f6b83f2df93f24c3e60a73dfe54ee226",
-    "docs/new-wsl-handbook.md": "c28e1c488cdc3e9e401ca65de69f61cbf15e22786404fac840a50fc823c96be3"
+    "docs/new-wsl-handbook.json": "93682c255f4cb4b06b250805b3529e155c7172e53e0387d97cacfd039fffa282",
+    "docs/new-wsl-handbook.md": "73fff09e4c2d193cd4b05d3e0ecde1fc45307c1214367d616c53e7ff0766b03e"
   },
   "inventory": {"layers": 37, "profile_entries": 69, "projected_tools": 73, "canonical_package_ids": 20},
   "validation": [

(c) Real CodexIntegrationTests against codex-cli 0.160.0 at a1a5488e

Binary. I downloaded the npm tarballs outside every repo and checked them against this PR's own pins. The host's production Codex install was not touched.

• codex-0.160.0.tgz: sha256 373517768e912eeb5054024ae9215e2c90a1420957b66fe134ef745a00948d4a.
• codex-0.160.0-linux-x64.tgz: sha256 37a41d61c3399182b8c727b77090cc7a1566bd849d0f09070a0bbc6fec4c58dc.
• Both equal adoption/pins-linux-x86_64.json.
• The extracted vendor/x86_64-unknown-linux-musl/bin/codex hashes to 12eb3e81114588aca3b7998f4f19e8997b056aca08e57a7ca7c8a3ec8c652aad, the pinned installed_binary_check, and prints codex-cli 0.160.0. That bin/ came first on PATH.

Command (2026-10-04T04:07:26Z to 04:09:04Z, TMPDIR under /var/tmp):

NAS_CODEX_INTEGRATION=1 nice -n 19 python3 -B -m unittest tests.test_codex_worker_lane.CodexIntegrationTests -v

Exit 0. Ran 10 tests in 98.146s, OK. All 10 ran, none skipped:

• test_a_project_config_outranks_the_profile_but_not_the_pinned_flags: ok
• test_codex_follows_links_below_agents_and_the_role_count_never_undercounts_it: ok
• test_real_app_server_apply_and_byte_exact_rollback: ok
• test_strict_config_refuses_the_launchers_model_flag: ok
• test_strict_config_refuses_the_stack_worker_profile_at_this_pin: ok
• test_the_doctor_reader_accepts_the_shipped_roles_and_flags_a_malformed_one: ok
• test_the_jcodemunch_recipe_step_registers_the_server_only_where_it_is_copied: ok
• test_the_omniroute_filter_keeps_the_key_out_of_commands: ok
• test_the_omniroute_profile_loads_strictly_and_names_its_key: ok
• test_worker_profile_sets_chub_opt_outs_in_an_isolated_home: ok

By its own docstring, the test class needs no sign-in, gateway or network. It uses scratch Codex homes. It runs the gateway-profile tests and the dry run's rehearsal under bwrap --unshare-net when bwrap works. On this host, both of its isolation probes return a working bwrap --unshare-net wrapper: the class's isolation() command and apply_codex_lane.bwrap_wrapper.

(d) Exit codes on a1a5488e

TMPDIR was under /var/tmp and each command ran under nice -n 19. Each exit code was read directly, not through a pipe.

Check	Exit
python3 scripts/validate.py (194 receipts, 9,745 hashed files)	0
python3 scripts/evidence_manifest.py --check (9,745 files)	0
python3 scripts/validate_convergence.py --all-recorded --root . --json (29 records, all valid)	0
python3 scripts/build_new_wsl_handbook.py --check	0
python3 -m unittest tests.test_new_wsl_handbook (72 tests)	0
python3 tools/adoption/new_wsl_client_config.py --check	0
python3 blueprints/blind-catalog-convergence/audit_reports.py --check	0
python3 tools/sota-convergence/build_verdicts.py --check	0
python3 scripts/component_matrix.py --check	0
python3 scripts/new_host_grand_list.py --check	0
python3 tools/sota-convergence/gap_crosswalk.py build --check	0
python3 tools/sota-convergence/gap_wave_ledger.py --wave gap-wave2-20260923 --wave gap-wave3-20260923 --owner gap-resolution --check	0
python3 scripts/build_ecosystem.py --check	0
python3 scripts/host_receipts.py validate (182 receipts)	0
This PR's eight test modules, from git diff --name-only e7c297e2 HEAD -- tests/ (445 tests)	0
tests.test_grand_dashboard, run because state.json changes (17 tests)	0
git diff --check e7c297e2...HEAD	0
Landing check merge_tree_landing_check.py e7c297e2 a1a5488e (conditions 1-5)	0 (LANDABLE)
The pre-push hook's three registry tests, in its own detached checkout of a1a5488e, during git push	0 (push exit 0)
The real CodexIntegrationTests in (c)	0

The eight modules are:

• test_adoption_bootstrap, test_adoption_bootstrap_linux_platform, test_adoption_bootstrap_macos and test_adoption_bootstrap_parity;
• test_adoption_contract and test_codex_worker_lane;
• test_new_wsl_profile and test_render_config.

They skipped 42 tests:

• 32 in test_adoption_bootstrap_macos: 17 need a real bash 3.2, 14 need PyYAML and 1 needs shellcheck;
• the 10 CodexIntegrationTests, which need NAS_CODEX_INTEGRATION=1 and ran in (c).

build_ecosystem.py --check passed. Its informational architecture_pin_drift lists two pins:

• seven codex rows, with edition pin 0.159.2 against stack pin 0.160.0;
• one nextjs row, with 16.3.6 against 16.3.8.

Main's own codex pin is 0.159.3, so the codex rows differ from main's pin as well.

The landing check against main e7c297e2 printed:

main e7c297e255c98337b54ff3d514191d5d1fa36354 head a1a5488e52c52ed2b1000d3d074e4efcad66d652 base e7c297e255c98337b54ff3d514191d5d1fa36354 merged-tree d7f79d231a79816c8311ad85c5759f4f4039d5f4 merge-tree-exit 0
ok   1: clean three-way merge
ok   2: merged-vs-main paths 88, outside PR-owned 0 []
ok   3: main drift 0 paths, overlap with PR-owned inputs (registry excluded) []
ok   4: registry foreign rows equal True, order preserved True, PR-owned rows 87, unowned top-level keys differing []
ok   5: merged files[] sorted by path with no duplicates: True (9745 rows)
LANDABLE

(e) Exact-head note

Acknowledgements given for 36d45155 name that head. Since then, the only content differences in this PR's own paths are the four listed in (a). The runtime receipt stays compatibility_attempt.

[socket-security]

Dependency limit exceeded — report not shown.

This pull request scan exceeded the 10,000-dependency limit applied to this scan, so the results are incomplete and may be inaccurate. To avoid reporting false positives, Socket has not posted a report.

Upgrade your plan to raise the dependency limit and get complete reports, or view the partial scan in the dashboard.

Socket is always free for open source. If this is a non-commercial open source project, contact us to request a free Team account.

[seathatflowsinourveins]

Claude session native-agent-stack-5f: head 0be2b134f6ec605f9b65fef58867627aef6ef786 applies the configuration owner's scope decision and refreshes this PR onto main fdd0a247aee96f21c4eff309bacdb3af322eb873. The landing check prints LANDABLE against that main.

The configuration owner's decision. adoption/new-wsl-profile.json, adoption/new-wsl-profile.md and the new-WSL handbook are out of #626. The owner moves them, with the Codex handbook rows, in their own follow-up.

• This PR therefore no longer changes the profile, its test, the handbook or the handbook receipt. All six equal main's copies: git diff fdd0a247 HEAD --stat over the six prints nothing.
• The profile keeps its owner-reviewed Codex pins (0.159.3) while manifests/stack.json moves to 0.160.0. No check fails on that split; see (c).
• adoption/README.md already says that the replacement-WSL profile and its handbook keep their owner-reviewed versions until that owner updates them.

Acknowledgements and ownership.

• The CC states the following. Under the user's decision of 2026-10-04, the work of stopped goal sessions is dispatched by the CC. So the CC's ACK stands in for the exact-head ACKs of the stopped Codex root lane and the Codex trading lane. This comment records that statement and is not itself an ACK.
• Per the CC, session native-agent-stack-5f is session 0c's continuation and still owns the Codex pin.

Commits. Pushed normally as a1a5488e..0be2b134, with no force-push and no rebase.

1. 9bb0b1e9 applies the scope decision on top of a1a5488e. Its tree is ba48d6b3.
   • The two profile files are restored to main's copies.
   • It reverts this PR's only hunk in tests/test_new_wsl_profile.py, which asserted 0.160.0 for the profile's Codex CLI pin, accepted_codex_cli_pin and the Python SDK pin. The file now equals main's copy, so no other hunk remains.
   • python3 scripts/build_new_wsl_handbook.py --write with main's profile reproduces main's two handbook files.
   • The three receipt hash lines are set back to the values that the restored profile and the regenerated outputs require, so the receipt equals main's copy.
   • The six files are re-registered with host_receipts.register_file, so their rows equal main's.
2. 0df81961 merges main fdd0a247 (Port #566 historical native runtime evidence #668 and Retire the gateway A/B R02 draft and record the overtaken 20128 freeze #656, two commits after e7c297e2). Its parents are 9bb0b1e9 and fdd0a247; its tree is 65389f4a. Only manifests/evidence.json conflicted:
   • I took main's copy and appended this PR's runtime-sdk-20261003 row after main's new last row.
   • new_host_grand_list.py --write re-registered the two grand-list outputs, after its --check passed. register_file re-registered this PR's other 79 files.
   • Main's other 9,697 rows are unchanged and in main's order, and convergence_records equals main's.
   • Main changed none of this PR's other paths, nor stack.json or state.json.
3. e61efc32 sets manifests/stack.json, manifests/evidence.json and observability/grand-dashboard/state.json to main's copies, per the hot-file protocol. Its tree is c7cfce13.
4. 0be2b134 restores this branch's copies, so all three are in the last commit. Its tree is 65389f4a, the merge commit's tree.

Main has since moved to f474f6d2. This head was not merged again, and every check below is against fdd0a247.

(a) Scope proof, a1a5488e → 0be2b134

I compared each head's PR diff against its own merge base: e7c297e2 before, fdd0a247 after.

• Owned paths. The PR owns 88 paths before and 82 after. The six scope files left the set, and none joined. git patch-id --stable is identical for 81 of the 82; the registry differs.
• The six scope files have no diff against main now:
  • adoption/new-wsl-profile.json and adoption/new-wsl-profile.md;
  • tests/test_new_wsl_profile.py;
  • docs/new-wsl-handbook.json and docs/new-wsl-handbook.md;
  • evidence/artifacts/new-wsl-handbook-20261001/receipt.json.
• manifests/evidence.json. Its PR patch is the old one minus the 20 +/- lines of the six rows, and it has no +/- line that the old patch lacked. Only its context changed: main's Port #566 historical native runtime evidence #668/Retire the gateway A/B R02 draft and record the overtaken 20128 freeze #656 rows, and the receipt row's insertion point after main's new last receipt.
• Owned registry rows. There are 87 before and 81 after. The six rows left and none joined. The 81 rows owned at both heads have identical values.
• Receipts and convergence records. The PR's runtime-sdk-20261003 row is identical at both heads. The PR leaves convergence_records untouched.

(b) Real CodexIntegrationTests

I did not run them again, because no Codex-lane integration input changed between a1a5488e and 0be2b134:

• The 43 paths that changed between those heads are the six scope files and main's Port #566 historical native runtime evidence #668/Retire the gateway A/B R02 draft and record the overtaken 20128 freeze #656 paths.
• None of them is under tools/adoption/, adoption/templates/, adoption/agents/, adoption/sdk/, adoption/skills/, adoption/hooks/ or recipes/.
• None of them is adoption/pins-linux-x86_64.json, manifests/stack.json or tests/test_codex_worker_lane.py.
• No exact path among them is named by tests/test_codex_worker_lane.py or any tools/adoption/*.py. Neither the test module nor any of those modules names manifests/evidence.json.

The run at a1a5488e therefore stands: 2026-10-04T04:07:26Z to 04:09:04Z, against codex-cli 0.160.0 checked against this PR's pins, exit 0, all 10 ok, none skipped.

(c) Exit codes on 0be2b134

TMPDIR was under /var/tmp and each command ran under nice -n 19. Each exit code was read directly, not through a pipe.

Check	Exit
python3 scripts/validate.py (195 receipts, 9,778 hashed files)	0
python3 scripts/evidence_manifest.py --check (9,778 files)	0
python3 scripts/validate_convergence.py --all-recorded --root . --json (30 records, all valid)	0
python3 scripts/build_new_wsl_handbook.py --check	0
python3 -m unittest tests.test_new_wsl_handbook (72 tests)	0
python3 -B -m unittest tests.test_new_wsl_profile, with main's profile and the 0.160.0 stack pin (17 tests)	0
python3 tools/adoption/new_wsl_client_config.py --check	0
python3 blueprints/blind-catalog-convergence/audit_reports.py --check	0
python3 tools/sota-convergence/build_verdicts.py --check	0
python3 scripts/component_matrix.py --check	0
python3 scripts/new_host_grand_list.py --check	0
python3 tools/sota-convergence/gap_crosswalk.py build --check	0
python3 tools/sota-convergence/gap_wave_ledger.py --wave gap-wave2-20260923 --wave gap-wave3-20260923 --owner gap-resolution --check	0
python3 scripts/build_ecosystem.py --check	0
python3 scripts/host_receipts.py validate (182 receipts)	0
This PR's seven test modules, from git diff --name-only fdd0a247 HEAD -- tests/ (428 tests)	0
tests.test_grand_dashboard, run because state.json changes (17 tests)	0
git diff --check fdd0a247...HEAD	0
Landing check merge_tree_landing_check.py fdd0a247 0be2b134 (conditions 1-5)	0 (LANDABLE)
The pre-push hook's three registry tests, in its own detached checkout of 0be2b134, during git push	0 (push exit 0)

The seven modules skipped the same 42 tests as at a1a5488e:

• 32 in test_adoption_bootstrap_macos;
• the 10 CodexIntegrationTests; see (b).

build_ecosystem.py --check's informational architecture_pin_drift is unchanged: seven codex rows and one nextjs row.

The landing check against main fdd0a247 printed:

main fdd0a247aee96f21c4eff309bacdb3af322eb873 head 0be2b134f6ec605f9b65fef58867627aef6ef786 base fdd0a247aee96f21c4eff309bacdb3af322eb873 merged-tree 65389f4a9d8e05adcb925d00fd4d63ea4306a418 merge-tree-exit 0
ok   1: clean three-way merge
ok   2: merged-vs-main paths 82, outside PR-owned 0 []
ok   3: main drift 0 paths, overlap with PR-owned inputs (registry excluded) []
ok   4: registry foreign rows equal True, order preserved True, PR-owned rows 81, unowned top-level keys differing []
ok   5: merged files[] sorted by path with no duplicates: True (9778 rows)
LANDABLE

[seathatflowsinourveins]

Claude session native-agent-stack-5f: landing at head 999b0dbbe8ba7df766f13f152cdd664a117ad6f1. The command center (wsl-architecture-design) gave its ACK at 8a7ee3e2ac94, which reaches this head only through recorded mechanical refreshes whose owned non-registry patch-ids are equal (its carry rule); under the user's 2026-10-04 decision it owns merges that touch the hot registry. The read-only cross-family review (GPT-6.1 Sol max, the packaged Codex SDK worker) returned ACCEPT at 8a7ee3e2ac94; this head is reached from it through recorded carry edges (equal owned patch-ids, or a cross-family delta read returning ACCEPT at the edge's target), with no P1 item.

Observed main b5b9c9ddbb8974f23e621d296feb748888d963ba. coordination/merge_tree_landing_check.py (sha256 a11649fcf2e5844c…) exit 0:

main b5b9c9ddbb8974f23e621d296feb748888d963ba head 999b0dbbe8ba7df766f13f152cdd664a117ad6f1 base ba0e8c48f339f8327cb1c2ee9abdfc6ca9bbce9c merged-tree 9fca1b411c7485cb02a7d3f04611e99e1e120cce merge-tree-exit 0
ok   1: clean three-way merge
ok   2: merged-vs-main paths 82, outside PR-owned 0 []
ok   3: main drift 13 paths, overlap with PR-owned inputs (registry excluded) []
ok   4: registry foreign rows equal True, order preserved True, PR-owned rows 81, unowned top-level keys differing []
ok   5: merged files[] sorted by path with no duplicates: True (9864 rows)
LANDABLE
condition 5: merged files[] sorted and unique (tree 9fca1b411c7485cb02a7d3f04611e99e1e120cce)

Required checks at this head: 8 pass . Unresolved review threads: 0.

NativeStack host exception (dated 2026-10-04).

• This PR moves the one shared Linux Codex row to 0.160.0. That covers adoption/pins-linux-x86_64.json (including the daemon pin), manifests/stack.json and the Codex lane tooling.
• NativeStack's interactive Codex and daemon stay at the qualified 0.159.3 on purpose, until NativeStack retires or per-host Codex pins land. NativeStack's 0.159.3 is below the repository pin by decision, not by drift.
• Until then, do not run bootstrap-linux.sh or apply_codex_lane.py on NativeStack. Both install the pin, so either would move it.
• NativeStack2604 and the SDK workers run 0.160.0.

Basis:

• The command center's CLI-currency resolution of 2026-10-04: X18 holds NativeStack at 0.159.3, and R6 is the per-host pin design.
• Its decision of the same day to land this PR on the shared row (option a) rather than wait for R6.

Sessions:

• wsl-architecture-design (the command center) made the decision.
• native-agent-stack-5f (formerly native-agent-stack-0c) owns the Codex pin and the R6 follow-up pull request. That PR gives NativeStack 0.159.3 and NativeStack2604 0.160.0, with the boundary pins and tests R6 lists.

Not in this PR: by the configuration owner's decision, the new-WSL profile and handbook stay at 0.159.3 here and move in that owner's follow-up.

[seathatflowsinourveins]

Claude session native-agent-stack-5f: post-merge observation. Landed as f77a35eb2bf30bc4bf6f3b4ee51bc9ce5397b4c5 (parent b5b9c9ddbb8974f23e621d296feb748888d963ba), tree 9fca1b411c7485cb02a7d3f04611e99e1e120cce. The landed tree equals the checked merged tree and the parent is the observed main.